The bomb threats at the University of Texas at Austin and North Dakota State University in Fargo on Friday that canceled classes and forced campus evacuations turned out to be nothing more than hoaxes. By early afternoon, no explosive devices were found and both schools had reopened their campuses. But whether the bomb threats were legitimate — the UT caller claimed to be linked to al-Qaeda — didn’t matter. In a post–Virginia Tech world, colleges have learned the hard way that safe is always better than sorry.

In 2008, after the shooting at Virginia Tech the year prior, Congress beefed up the Clery Act, which requires universities to disclose the amount of crime on campus. New stipulations call for colleges to have an official emergency plan, including a procedure to immediately notify the campus community in the event of an emergency. “Al-Qaeda does not typically call you in advance, but that doesn’t mean you don’t have to take threats very seriously,” said S. Daniel Carter, a campus safety expert who runs the 32 National Campus Safety Index.

Active shooter drills and test evacuations are now a typical part of college life. And while that is certainly not to be discouraged, in being prepared to respond quickly to any threat, colleges run the risk of their students observing warnings with less urgency. In part, that is because the vast majority of bomb threats turn out to be fake.

Jason Friedberg, the retired chief of public safety at Pennsylvania’s Bucknell University who now runs the campus-safety consulting firm Visium Global, estimates that as many as “99.999%” of bomb threats are hoaxes. While no organization tracks the number of threats that U.S. colleges receive each year, experts say there is no doubt the number of threats far outweighs the number of bombs found on campuses. Since 2000, the Alcohol, Tobacco, Firearms and Explosives’ Bomb Data Center has recorded 46 “bomb incidents” at universities, but Friedberg estimates every college receives a handful of threats each year.

Nevertheless, all threats are presumed true, and response procedures are commonplace at universities. They start with the phone call. Most action plans instruct that the school official who receives the call obtain as much information from the caller as possible, including the specific location of the bomb, the detonation time and its appearance. Responders are also directed to take note of the person’s gender, accent and, if possible, ethnicity. Afterward, it’s up to the university administration, campus police, local and often federal law enforcement to decide how to act.

Authorities attempt to get a sense of the nature, credibility and urgency of the threat, frequently with little information, according to Gene Deisinger, director of threat management at Virginia Tech’s campus police department. This assessment involves asking whether the caller has detailed knowledge of the interior space where he or she claims to have planted the bomb and determining the feasibility of their claims. “I have planted a nuclear device” is less likely to be taken seriously, he said. Officials also weigh local and world events that could be contributing to the threat, as well as factors — is it midterm week, for example — that can spell a hoax. And a decision must be taken quickly — evacuating a 40,000-person campus is no small or speedy undertaking. But being correct is important too. “It’s a double-edged sword,” Deisinger said. “We want to inform people as soon as possible, but to do that often means going public with little, less accurate information.” If an evacuation is ordered, in most cases universities only need to evacuate the building pointed out by the caller. Experts say full evacuations, like what occurred Friday in Texas and North Dakota, are rare.

While it makes sense to evacuate rather than taking a chance, evacuations are incredibly disruptive. The University of Pittsburgh, for example, received more than 60 (and some estimates say as many as 145) bomb threats between February and April, which forced the evacuation of more than 100 buildings at various times. Over time, as the threats went from alarming to annoying, the university changed the way it responded, from automatically evacuating the building named in the threat to sending in teams to search for an explosive before further action was taken. “Evacuations are a huge disruption to campus,” said Friedberg. “At a certain point they began operating under the assumption that there was almost no chance that it was a legitimate threat.”

But not acting is an enormous risk. As officials at Virginia Tech found out, failing to notify the campus community in a timely manner, which the Clery Act required even before it was modified in 2008, can be a deadly offense. On April 16, 2007, when two students were found dead in a residence hall, the university waited two hours before notifying students. Around the same time the notice finally went out, the shooter was chaining up the three main entrances at Norris Hall, where he would murder an additional 30 people before killing himself.

Universities have a particular responsibility to respond without error because when parents send their kids off to college, they are trusting university officials to keep them safe. “Campuses are held to a different standard,” Deisinger said. “It is abundantly clear that there is a much higher expectation for safety at colleges than in other places.” But that’s a reasonable expectation, said Alison Kiss, executive director of the Clery Center for Security on Campus. “Parents are making a huge investment, and they should be able to have confidence that their children will have the opportunity to learn in a safe environment.” Which is why if there are any copycat bomb threats next week in the wake of the Texas and North Dakota scares, you can be sure the universities will take action.

Kayla Webley is a Staff Writer at TIME. Find her on Twitter at @kaylawebley, on Facebook or on Google+. You can also continue the discussion on TIME’s Facebook page and on Twitter at @TIME.